Your /:\D/ pattern matches a colon and any non-digit symbol and can thus match a :/ inside a protocol part of an URL.

If you meant a :D smiley, just use /:D/. Same goes for all the literal letters and digits: do not escape them. Also, there is no point using capturing groups around whole patterns, if you need to reference the match values in the replacement pattern, just use $& (not $1).

Another hint: you might want to use word boundaries and non-word boundaries, like /\B:\)\B/ or /\B:D\b/ (adding non-word boundary \B before/after non-word chars and word boundaries \b before/after word chars) to match these smileys as "whole words", but it is difficult to say without the actual data.